DESCRIPTION

The
sar
command writes to standard output the contents of selected
cumulative activity counters in the operating system. The accounting
system, based on the values in the
count
and
interval
parameters, writes information the specified number of times spaced
at the specified intervals in seconds.
If the
interval
parameter is set to zero, the
sar
command displays the average statistics for the time
since the system was started. The default value for the
count
parameter is 1. If its value is set to zero, then reports are
generated continuously.
The collected data can also
be saved in the file specified by the
-ofilename
flag, in addition to being displayed onto the screen. If
filename
is omitted, sar uses the standard system activity daily data file,
the
/var/log/sa/sadd
file, where the dd parameter indicates the current day.
By default all the data available from the kernel are saved in the
data file. Exceptions are interrupts and disks data, for which the
relevant options must be explicitly passed to sar (or to its backend
sadc
) when the data file is created (see options below).

The
sar
command extracts and writes to standard output records previously
saved in a file. This file can be either the one specified by the
-f
flag or, by default, the standard system activity daily data file.

Without the
-P
flag, the
sar
command reports system-wide (global among all processors) statistics,
which are calculated as averages for values expressed as percentages,
and as sums otherwise. If the
-P
flag is given, the
sar
command reports activity which relates to the specified processor or
processors. If
-P ALL
is given, the
sar
command reports statistics for each individual processor and global
statistics among all processors.

You can select information about specific system activities using
flags. Not specifying any flags selects only CPU activity.
Specifying the
-A
flag is equivalent to specifying
-bBcdqrRuvwWy -I SUM -I XALL -n ALL -P ALL.

The default version of the
sar
command (CPU utilization report) might be one of the first facilities
the user runs to begin system activity investigation, because it
monitors major system resources. If CPU utilization is near 100 percent
(user + nice + system), the workload sampled is CPU-bound.

If multiple samples and multiple reports are desired, it is convenient
to specify an output file for the
sar
command.
Run the
sar
command as a background process. The syntax for this is:

sar -o datafile interval count >/dev/null 2>&1 &

All data is captured in binary form and saved to a file (datafile).
The data can then be selectively displayed with the
sar
command using the
-f
option. Set the
interval
and
count
parameters to select
count
records at
interval
second intervals. If the
count
parameter is not set, all the records saved in the
file will be selected.
Collection of data in this manner is useful to characterize
system usage over a period of time and determine peak usage hours.

Note:Thesar
command only reports on local activities.

OPTIONS

Report I/O and transfer rate statistics.
The following values are displayed:

tps

Total number of transfers per second that were issued to physical devices.
A transfer is an I/O request to a physical device. Multiple logical
requests can be combined into a single I/O request to the device.
A transfer is of indeterminate size.

rtps

Total number of read requests per second issued to physical devices.

wtps

Total number of write requests per second issued to physical devices.

bread/s

Total amount of data read from the devices in blocks per second.
Blocks are equivalent to sectors with 2.4 kernels and newer
and therefore have a size of 512 bytes. With older kernels, a block is of
indeterminate size.

bwrtn/s

Total amount of data written to devices in blocks per second.

-B

Report paging statistics. The following values are displayed:

pgpgin/s

Total number of kilobytes the system paged in from disk per second.
Note: With old kernels (2.2.x) this value is a number of blocks per
second (and not kilobytes).

pgpgout/s

Total number of kilobytes the system paged out to disk per second.
Note: With old kernels (2.2.x) this value is a number of blocks per
second (and not kilobytes).

fault/s

Number of page faults (major + minor) made by the system per second
(post 2.5 kernels only).
This is not a count of page faults that generate I/O, because some page
faults can be resolved without I/O.

majflt/s

Number of major faults the system has made per second, those which
have required loading a memory page from disk
(post 2.5 kernels only).

-c

Report process creation activity.

proc/s

Total number of processes created per second.

-d

Report activity for each block device (kernels 2.4 and newer only).
When data is displayed, the device specification
dev m-n
is generally used (
DEV
column).
m
is the major number of the device.
With recent kernels (post 2.5),
n
is the minor number of the device, but is only a sequence number with
pre 2.5 kernels. Device names may also be pretty-printed if option -p
is used (see below). Values for fields avgqu-sz, await, svctm and %util
may be unavailable and displayed as 0.00 with some 2.4 kernels.

tps

Indicate the number of transfers per second that were issued to the device.
Multiple logical requests can be combined into a single I/O request to the
device. A transfer is of indeterminate size.

rd_sec/s

Number of sectors read from the device. The size of a sector is 512 bytes.

wr_sec/s

Number of sectors written to the device. The size of a sector is 512 bytes.

avgrq-sz

The average size (in sectors) of the requests that were issued to the device.

avgqu-sz

The average queue length of the requests that were issued to the device.

await

The average time (in milliseconds) for I/O requests issued to the device
to be served. This includes the time spent by the requests in queue and
the time spent servicing them.

svctm

The average service time (in milliseconds) for I/O requests that were issued
to the device.

%util

Percentage of CPU time during which I/O requests were issued to the device
(bandwidth utilization for the device). Device saturation occurs when this
value is close to 100%.

-e [ hh:mm:ss ]

Set the ending time of the report. The default ending time is
18:00:00. Hours must be given in 24-hour format.
This option can be used only when data are read from
or written to a file (options
-f
or
-o
).

-f [ filename ]

Extract records from
filename
(created by the
-o filename
flag). The default value of the
filename
parameter is the current daily data file, the
/var/log/sa/sadd
file. The -f option is exclusive of the -o option.

-i interval

Select data records at seconds as close as possible to the number specified
by the
interval
parameter.

-I { irq | SUM | ALL | XALL }

Report statistics for a given interrupt.
irq
is the interrupt number. Specifying multiple
-I irq
parameters on the command line will look at multiple independent interrupts.
The
SUM
keyword indicates that the total number of interrupts received per second
is to be displayed. The
ALL
keyword indicates that statistics from
the first 16 interrupts are to be reported, whereas the
XALL
keyword indicates that statistics from all interrupts, including potential
APIC interrupt sources, are to be reported.

-n { DEV | EDEV | NFS | NFSD | SOCK | ALL }

Report network statistics.

With the
DEV
keyword, statistics from the network devices are reported.
The following values are displayed:

IFACE

Name of the network interface for which statistics are reported.

rxpck/s

Total number of packets received per second.

txpck/s

Total number of packets transmitted per second.

rxbyt/s

Total number of bytes received per second.

txbyt/s

Total number of bytes transmitted per second.

rxcmp/s

Number of compressed packets received per second (for cslip etc.).

txcmp/s

Number of compressed packets transmitted per second.

rxmcst/s

Number of multicast packets received per second.

With the
EDEV
keyword, statistics on failures (errors) from the network devices are reported.
The following values are displayed:

IFACE

Name of the network interface for which statistics are reported.

rxerr/s

Total number of bad packets received per second.

txerr/s

Total number of errors that happened per second while transmitting packets.

coll/s

Number of collisions that happened per second while transmitting packets.

rxdrop/s

Number of received packets dropped per second because of a lack of space in linux buffers.

txdrop/s

Number of transmitted packets dropped per second because of a lack of space in linux buffers.

txcarr/s

Number of carrier-errors that happened per second while transmitting packets.

rxfram/s

Number of frame alignment errors that happened per second on received packets.

rxfifo/s

Number of FIFO overrun errors that happened per second on received packets.

txfifo/s

Number of FIFO overrun errors that happened per second on transmitted packets.

With the
NFS
keyword, statistics about NFS client activity are reported.
The following values are displayed:

call/s

Number of RPC requests made per second.

retrans/s

Number of RPC requests per second, those which needed to be retransmitted (for
example because of a server timeout).

read/s

Number of 'read' RPC calls made per second.

write/s

Number of 'write' RPC calls made per second.

access/s

Number of 'access' RPC calls made per second.

getatt/s

Number of 'getattr' RPC calls made per second.

With the
NFSD
keyword, statistics about NFS server activity are reported.
The following values are displayed:

scall/s

Number of RPC requests received per second.

badcall/s

Number of bad RPC requests received per second, those whose
processing generated an error.

packet/s

Number of network packets received per second.

udp/s

Number of UDP packets received per second.

tcp/s

Number of TCP packets received per second.

hit/s

Number of reply cache hits per second.

miss/s

Number of reply cache misses per second.

sread/s

Number of 'read' RPC calls received per second.

swrite/s

Number of 'write' RPC calls received per second.

saccess/s

Number of 'access' RPC calls received per second.

sgetatt/s

Number of 'getattr' RPC calls received per second.

With the
SOCK
keyword, statistics on sockets in use are reported.
The following values are displayed:

totsck

Total number of used sockets.

tcpsck

Number of TCP sockets currently in use.

udpsck

Number of UDP sockets currently in use.

rawsck

Number of RAW sockets currently in use.

ip-frag

Number of IP fragments currently in use.

The
ALL
keyword is equivalent to specifying all the keywords above and therefore all the network
activities are reported.

-o [ filename ]

Save the readings in the file in binary form. Each reading
is in a separate record. The default value of the
filename
parameter is the current daily data file, the
/var/log/sa/sadd
file. The -o option is exclusive of the -f option.

-P { cpu | ALL }

Report per-processor statistics for the specified processor or processors.
Specifying the
ALL
keyword reports statistics for each individual processor, and globally for
all processors.
Of the flags which specify the statistics to be reported, only the
-u
and
-I SUM
flags are meaningful with the
-P
flag. Note that processor 0 is the first processor.

-p

Pretty-print device names. Use this option in conjunction with option -d.
By default names are printed as
dev m-n
where m and n are the major and minor numbers for the device.
Use of this option displays the names of the devices as they (should) appear
in /dev. Name mappings are controlled by
/etc/sysconfig/sysstat.ioconf.

-q

Report queue length and load averages. The following values are displayed:

runq-sz

Run queue length (number of processes waiting for run time).

plist-sz

Number of processes and threads in the process list.

ldavg-1

System load average for the last minute.

ldavg-5

System load average for the past 5 minutes.

ldavg-15

System load average for the past 15 minutes.

-r

Report memory and swap space utilization statistics.
The following values are displayed:

kbmemfree

Amount of free memory available in kilobytes.

kbmemused

Amount of used memory in kilobytes. This does not take into account memory
used by the kernel itself.

%memused

Percentage of used memory.

kbbuffers

Amount of memory used as buffers by the kernel in kilobytes.

kbcached

Amount of memory used to cache data by the kernel in kilobytes.

kbswpfree

Amount of free swap space in kilobytes.

kbswpused

Amount of used swap space in kilobytes.

%swpused

Percentage of used swap space.

kbswpcad

Amount of cached swap memory in kilobytes.
This is memory that once was swapped out, is swapped back in
but still also is in the swap area (if memory is needed it doesn't need
to be swapped out again because it is already in the swap area. This
saves I/O).

-R

Report memory statistics. The following values are displayed:

frmpg/s

Number of memory pages freed by the system per second.
A negative value represents a number of pages allocated by the system.
Note that a page has a size of 4 kB or 8 kB according to the machine architecture.

bufpg/s

Number of additional memory pages used as buffers by the system per second.
A negative value means fewer pages used as buffers by the system.

campg/s

Number of additional memory pages cached by the system per second.
A negative value means fewer pages in the cache.

-s [ hh:mm:ss ]

Set the starting time of the data, causing the
sar
command to extract records time-tagged at, or following, the time
specified. The default starting time is 08:00.
Hours must be given in 24-hour format. This option can be
used only when data are read from a file (option
-f
).

-t

When reading data from a daily data file, indicate that
sar
should display the timestamps in the original locale time of
the data file creator. Without this option, the
sar
command displays the timestamps in the user's locale time.

-u

Report CPU utilization. The following values are displayed:

%user

Percentage of CPU utilization that occurred while executing at the user
level (application).

%nice

Percentage of CPU utilization that occurred while executing at the user
level with nice priority.

%system

Percentage of CPU utilization that occurred while executing at the system
level (kernel).

%iowait

Percentage of time that the CPU or CPUs were idle during which
the system had an outstanding disk I/O request.

%steal

Show the percentage of time spent in involuntary wait by the virtual CPU
or CPUs while the hypervisor was servicing another virtual processor.

%idle

Percentage of time that the CPU or CPUs were idle and the system
did not have an outstanding disk I/O request. Note: In virtualized hardware
environment, this also includes the time spent in involuntary wait by the virtual CPU
or CPUs while the hypervisor was servicing another virtual processor.

-v

Report status of inode, file and other kernel tables.
The following values are displayed:

dentunusd

Number of unused cache entries in the directory cache.

file-sz

Number of used file handles.

inode-sz

Number of used inode handlers.

super-sz

Number of super block handlers allocated by the kernel.

%super-sz

Percentage of allocated super block handlers with regard to the maximum number
of super block handlers that Linux can allocate.

dquot-sz

Number of allocated disk quota entries.

%dquot-sz

Percentage of allocated disk quota entries with regard to the maximum number
of cached disk quota entries that can be allocated.

rtsig-sz

Number of queued RT signals.

%rtsig-sz

Percentage of queued RT signals with regard to the maximum number
of RT signals that can be queued.

-V

Print version number then exit.

-w

Report system switching activity.

cswch/s

Total number of context switches per second.

-W

Report swapping statistics. The following values are displayed:

pswpin/s

Total number of swap pages the system brought in per second.

pswpout/s

Total number of swap pages the system brought out per second.

-x { pid | SELF | ALL }

Report statistics for a given process.
pid
is the process identification number. The
SELF
keyword indicates that statistics are to be reported for the
sar
process itself, whereas the
ALL
keyword indicates that statistics are to be reported for all the system processes.
All these statistics cannot be saved to a file.
So this option will be ignored whenever -o option is used.
Specifying multiple
-x pid
parameters on the command line will look at multiple independent processes.
At the present time, no more than 256 processes can be monitored
simultaneously.

The following values are displayed:

minflt/s

Total number of minor faults the process has made per second, those
which have not required loading a memory page from disk.

majflt/s

Total number of major faults the process has made per second, those
which have required loading a memory page from disk.

%user

Percentage of CPU used by the process while executing at the user level
(application), with or without nice priority.

%system

Percentage of CPU used by the process while executing at the system level
(kernel).

nswap/s

Number of pages from the process address space the system has swapped out per second.
This value is always zero with post 2.5 kernels.

CPU

Processor number to which the process is attached.

-X { pid | SELF | ALL }

Report statistics for the child processes of the process whose PID is
pid .
The
SELF
keyword indicates that statistics are to be reported for the child processes of the
sar
process itself, whereas the
ALL
keyword indicates that statistics are to be reported for all the child processes
of all the system processes.
All these statistics cannot be saved to a file.
So this option will be ignored whenever -o option is used.
Specifying multiple
-X pid
parameters on the command line will look at multiple independent processes.
At the present time, no more than 256 processes can be monitored
simultaneously.
The following values are displayed:

cminflt/s

Total number of minor faults the child processes have made per second, those
which have not required loading a memory page from disk.

cmajflt/s

Total number of major faults the child processes have made per second, those
which have required loading a memory page from disk.

%cuser

Percentage of CPU used by the child processes while executing at the user level
(application), with or without nice priority.

%csystem

Percentage of CPU used by the child processes while executing at the system level
(kernel).

cnswap/s

Number of pages from the child processes address spaces the system has swapped out per second.
This value is always zero with post 2.5 kernels.

-y

Report TTY device activity. The following values are displayed:

rcvin/s

Number of receive interrupts per second for current serial line. Serial line number
is given in the TTY column.

xmtin/s

Number of transmit interrupts per second for current serial line.

framerr/s

Number of frame errors per second for current serial line.

prtyerr/s

Number of parity errors per second for current serial line.

brk/s

Number of breaks per second for current serial line.

ovrun/s

Number of overrun errors per second for current serial line.

Note that with recent 2.6 kernels, these statistics can be retrieved only by
root.

ENVIRONMENT

The
sar
command takes into account the following environment variables:

S_TIME_FORMAT

If this variable exists and its value is
ISO
then the current locale will be ignored when printing the date in the report header.
The
sar
command will use the ISO 8601 format (YYYY-MM-DD) instead.

S_TIME_DEF_TIME

If this variable exists and its value is
UTC
then
sar
will save its data in UTC time (data will still be displayed in local time).
sar
will also use UTC time instead of local time to determine the current daily
data file located in the
/var/log/sa
directory.

EXAMPLES

sar -u 2 5

Report CPU utilization for each 2 seconds. 5 lines are displayed.

sar -I 14 -o int14.file 2 10

Report statistics on IRQ 14 for each 2 seconds. 10 lines are displayed.
Data are stored in a file called
int14.file.